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Investigation into igg-games & gamestorrent 

Date of publication - November 26th, 2018 


Overview 

The purpose of this document is to summarize information found online that reveals the 
identity of the individuals that operate the gaming piracy websites "igg-games.com" 
(http://igg-games.com/) and "gamestorrent.co" (http://gamestorrent.co/) which profit 
from the distribution of illegal copies of video games via advertisements (pop-up ads, etc). 
At the time of publication, they are ranked 1,305 and 5,958 globally by Alexa.com . 


Establishing a Commonly Used Username 

We must first identify a username used by the website owners on other sites or forums. As 
both websites use the content management system WordPress: we decided to look there. 

The tool we are using to accomplish this is WPScan . Here are the full scan results for both 
sites: 

• igg-games.com | https://pastebin.com/FOHwRjOg 

• gamestorrent.co | https://pastebin.com/iUnnSjBk 

We uncover the same WordPress username for both sites: vietphap123 


User(s) Identified: 

[+] vietphapl23 

| Detected By: Author Posts - Author Pattern (Passive Detection) 

| Confirmed By: 

| Wp Json Api (Aggressive Detection) 

1 - http://igg-games*com/wp-json/wp/v2/users/ 

| Author Id Brute Forcing - Author Pattern (Aggressive Detection) 
| Login Error Messages (Aggressive Detection) 


We have located the administrator account creating new posts on each website. As you can 
see here: 

• http://igg-games.com/author/vietphap123 | http://archive.is/k17LE 

• http://gamestorrent.co/author/vietphap123 | http://archive.is/2G4Ti 


Online Profiles 


Searching on Google reveals many hits for vietphap123: 
https://www.google.com/search?q="vietphap123" 
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Here are the important ones which we will mention: 

1. User vietphap123 on the OVH forums wanting to purchase a VPS (writes: "I think i 
will buy VPS at Online.net, bye"): 

https://forum.ovh.co.uk/showthread.php/9060-l-can-t-pay-for-VPS | 

http://archive.is/glAHH 

2. "IGGGAMER" WordPress site: https://igggamer.wordpress.com/author/vietphap123/ 
| http://archive.is/lyhu4 

3. Blogger.com site (Vietnamese): http://vietphap123.blogspot.com/ | 
http://archive.is/4TsM4 

4. Private Tracker trading forum (private trackers are a prime source for illegal copies 
of copyrighted content): 

https://www.invitescene.com/profile/7571-vietphap123/content/ | 

http://archive.is/fVw2l 

5. vietphapl 23 commenting on a GoDaddy coupon (site is in Vietnamese): 
https://canhme.com/godaddy-coupon/gd-coupon-thang-10-2013/ | 

http://archive.is/G4uN0 

6 . The igg-games.com Disqus account (used to manage comments on the site) is 
@vietphap123: https://disqus.com/by/vietphap123/ | http://archive.is/mCHYR 

7. vietphapl 23 posting a speedtest result on mmo4me.com (Vietnamese site): 
https://mmo4me.eom/threads/mang-cuc-cham-ngay-ca-trong-nuoc.147482/#post-3 

029190 | http://archive.is/BCgks 

8 . vietphapl 23 on voz.vn (Vietnamese site yet again) with "gamestorrent.co" in their 
profile signature: https://forums.voz.vn/member.php?u=486192 | 
http://archive.is/OXsqv 

9. Google Plus user vietphap vo with an "IGG" profile picture posting facebook 
hyperlinks: https://plus.google.com/110797677756935902362/posts/WSrVqARTfdG 
| http://archive.is/cn6BK 

10. YouTube profile: https://www.youtube.com/user/vietphap123 | 
http://archive.is/jj78c 

11. Facebook profile (which is deleted or has access restricted; lists two cities in 
Vietnam): http://archive.fo/gf1 Aa | https://www.facebook.com/vietphap123 

12. Steam profile (take note of the "phap" group with two members): 
https://steamcommunity.com/profiles/76561198057968528 | 
http://archive.is/Nmu3l (upon further research the other group member is named 
"Vietnhatvo" and their has their location as Viet Nam): 
https://steamcommunity.com/profiles/76561198065892744 | 

http://archive.is/9HA9T 

13. Vidinterest account and their name as Vo Viet Phap (a real name?): 
https://vidinterest.tv/vietphap123 | http://archive.is/n8lkD 

14. Twitter profile and their name as vo viet phap (mentions igg-games.com): 
https://twitter.com/installguidegam | http://archive.is/ahhPv 
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15. Imgur account that is 4+ years old: https://imgur.com/user/vietphap123/submitted | 
http://archive.is/DxgVu 

16. Photobucket: http://s329.photobucket.com/user/vietphap123/profile/ 

17. Another WordPress site that looks similar to igg-games.com: 
http://cheapserver.info/author/vietphap123 | http://archive.fo/mjYUv 

18. CS.RIN.RU account (requires to be signed in with an account to view profiles): 
https://cs.rin.ru/forum/memberlist.php?mode=viewprofile&u=544112 


W * 

CS.RIN.RU 

NonBteam Gaming Servers 

CS.RIN.RU - Steam Underground 
Community 

Make sure the URL in your address bar starts with the correct domain! 

£ Forum rules 


D Non-Steam FAQ :: B Members 

0 User Control Panel 

:: H 0 new messages 

0 Search :: R 

Last visit was: 1 minute; 

ago 

It is currently Wednesday, 21 Nov 2018, 13:25 

View unanswered posts | View active topics 

Board index 

View unread posts | View new posts | View your posts 

Viewing profile - vietphap!23 


Board presence 

User statistics 


vietphap!23 

Joined: Saturday, 06 Dec 2014, 15:18 

Last visited: less than a minute ago 

Total posts: 9 

[0.00% of all posts / 0.01 posts per day] 


With the information above, we can conclude that the individuals who operate 
"igg-games.com" and "gamestorrent.co" are from Vietnam and reuse vietphap123 as their 
username on various websites. Also, one of the individual's real name is possibly Vo Viet 
Phap 


Domain & DNS History 

Let's take a look at the WHOIS history for igg-games.com: 
https://whois.easycounter.com/igg-games.com 

Investigating the matbao.net entry at the very bottom, we get an address, phone number 
and again the name Vo Viet Phap: https://pastebin.com/E67XpF9M 

Name: Ong Vo Viet Phap 

Address: 62 An Diem, phuong 10, quan 5, Ho Chi Minh 70000 Vietnam 
Phone: +84.986918917 
Email: vietphapl 23@gmail.com 


Now, let's see if we can find where the website for igg-games.com is most likely hosted: 
https://securitytrails.eom/domain/igg-games.com/history/a | http://archive.is/FWat2 

The most recent result that is not Cloudflare is Online S.A.S. (or Online.net). Recall the 
post from vietphapl 23 on the OVH forums: "I think i will buy VPS at Online.net, bye" 
https://forum.ovh.co.uk/showthread.php/9060-l-can-t-pay-for-VPS | http://archive.is/glAHH 
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Using the login vietphap123 at the Online.net login recovery yields the same phone 
number and email address we found from past WHOIS entries: 


^•online 


English ▼ Subscribe Sign in 
Order ▼ API Support Webmaile 


Lost password 


Please select a contact address where you want to send password recovery information 


Associated contact information: 

Contacts : viet** 1 *^^(5)*mail.com * 

+ 84 . 9******17 * 

To ensure your privacy, only a portion of your email is displayed 


Confirms they are using Online.net servers for something. 


Compromised Accounts 

We decided to look in leaked databases for a password linked to the username 
vietphap123. The alias is reused everywhere, so most likely the password is too. 

Our suspicion was confirmed true, and many of the accounts at various sites are accessible 
using vietphapl 23 / vietphapl 23@gmail.com and the password we found. Some examples: 

vidinterest account 


jr* vidinterest 

/ Vietphap123@gmail.cc 


Settings 

A Profile 
A Password 
✓ Verification 
S Email Notification 


Profile 

Update your personal information 

1 Personal Information 

Name 



Vo Viet 

Middle Name 

Phap 

Gender* 



(§) Male 

© Female 


Username * 

Email * 


vietphapl 23 

vietphapl 23@gmail.com 


Country 

City Name 


-- Select Country -- 

NhaTrang 


Website 



http:// 
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mmo4me.com account 


£ vietphap123 ft Inbox Jl Alerts 



vietphap123 

Junior Member 




X 


■ 321 SELL: 3,026 


Your Profile Page 


Personal Details 

Your News Feed 

tphap123 




sages: 

75 

Signature 

Conversations 


18 



Is: 

8 

Contact Details 

Alerts 



Privacy 

Likes You've Received 


Preferences 

Your Content 


Alert Preferences 

People You Follow 


^Minh vVat» scam :( 


Avatar 

People You Ignore 

S c&g sut cA tftAg :( 


External Accounts 

Password 

Two-Step Verification 

click vao day nbo 




H Show online status Log Out 



MM!? PROFVEST 


CS.RIN.RU account - claims two brothers own and run the sites. 


Options 

Overview 

Profle 

Board preferences 
Private messages 
»Inbox 
» Outbox 
» Sent messages 
>* Compose message 
» Manage PM drafts 
» Rules, folders ft settings 
Userg roups 
Friends ft Foes 

Friends 

Online 

No friends online 
Offline 

No friends offline 


Next PM in history | Previous PM | Next PM 

Message subject: Re: IGGGAMES 

From: 

Sent: 

To: 


■HsESBa 

Wednesday, 03 Feb 2016, 20:30 
vletphapl23 


Print view | Forward PM 

View message 

vletphapl23 


Message history 


no 


Move to folder 


Folden Sent messages 


Message subject: IGGGAMES 

Hello, I’m Admin of IGG site, (contactme is my young brother's account). He did that launcher for me. And 
I saw that post, hehe. Still thanks for your helps and without remove copyright (Y) . I only know about 
SEO SEO SEO and SEO xD (I have many big sites on internet about movie, software, games,., not only 
IGG site) so I dont know about C++, C#,... 

But I was curious about how you did, I downloaded your game.exe file. And replace it to my file, but when 
start it, nothing happen. Where I need put it? (You can see image below, I put it in this folder, but nothing 
happen when double click -1 tested on 2 PC) 


http://i.imqur.com/DWGWN4Z.jpg 


Sent: Tuesday, 02 Feb 2016, 11:40 


View 
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filehoster account "UptoBox" 


My account 


Free member 


Hello vietphap123 

Number of points UTB : 103.80275 *i uptobox point = 1000 downloads on uptobox or iooo views on uptostream Convert my points 

My affiliate link: Q 
My referrals: 746 
Token: Q 

You have a voucher code ? 


Configuration 


Security lock OFF Enable 

Direct Download OFF Enable 

it You must be premium to access this feature 

Secure download (SSL) OFF Enable 

Direct download on your NAS (Download Station) 


My informations 


Email 

vietphapl 23@gmail.com 


Dumping the Imqur Account 

Most of the accounts we can login to on various websites do not provide any additional or 
incriminating evidence. But then we hit the motherload. 

Using the same credentials, we logged into the vietphapl 23 imgur account 
(https://imgur.com/user/vietphap123 | http://archive.is/tlVd1 1 and found it contained more 
than 100 unlisted images that confirm the individuals who own and operate 
"igg-games.com" and "gamestorrent.co" are two brothers from Vietnam: Vo Tan Phap and 
Vo Viet Phap. 

We've made these images public. You can view them here: https://bit.lv/2PWqbdS 

All the images from the account have been dumped and are available for download below: 

Anonfiles: https://bit.lv/2Twp4jO 


Analyzing the Evidence 


There is an enormous amount of evidence provided by the images obtained from the 
imgur account. We are going to analyze the most important ones in this section. 
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In images 3 - 3Wogp5V.jpg and 4 - oC6X667.jpg we can see the username of the computer 
in the Windows directory bar: PhapVo. This is related closely to the name we found earlier 
(Vo Viet Phap) from past WHOIS information and on various online accounts: 



• i#o§ m # 


k 

t ► Computer ► Local Disk [C:) ► Users ► PhapVo 

► Desktop ► IGG-Stick.RPG.2.Directors.Cut ► IGG-Stick.RPG.2.Directors.Cut 


Irganize » 

||] Open Share with ▼ New folder 




rs . , -r 


Taken from 3 - 3Wogp5V.jpg 




Organize 



Computer ► Local Disk (C:) ► Users 


Include in library T Share with T 


PhapVo ► Desktop 


New folder 


IGG-Celestial,Command.v0.57 ► 


Taken from 4 - oC6X667.jpg 


In image 18 - ubD8dHl.jpg we have a bank deposit slip from Vietcombank. Two names are 
listed: Vo Tan Phat and Vo Viet Phap. The address listed for Vo Viet Phap matches the one 
we found from past WHOIS information for igg-games.com: 62 An Diem, phuong 10, quan 
5, Ho Chi Minh. 

The details also mention this is for a virtual private server (VPS) -- Details: "Tien VPS". 



Taken from 18 - ubD8dHl.jpg 
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In the following images 42 - 9RLJbZj.jpg, 43 - yZdaDUa.jpg, and 44 - fEuZ7ve.jpg we have 
identification cards for Vo Viet Phap: 



Taken from 42 - 9RLJbZj.jpg 


C0NG HOA XA H0I CHU NGHIA iL i NAM 
O oc la p - fi/do - Ha nh ph uc 

GIAY CHUNG MINH NHAN DAN 

so 1.2 5 4 ^ 5 0 8 H 

Ho ten:. v8 viSi phjCp 

Sinh ngay 29-10-1991 

NguySn qu£n:. 

Binh j 

Ndi OKHK thu’dng tri63 
■ 


Taken from 43 -yZdaDUa.jpg 



CONG H0A XA H0I CHU NGHlA VffiT NAM 
D6c lap - Tir do - Hanh phuc 

GIAY PH^P LAI XE 

5 .) AM 4 06137 
Hovaten VOVlfiTPHAP 
Nam sinh 29/10/1991 Quoc tich ViStNam 
Nai cir tru 142/2 Bis Le Hong Phong 

Th.Phtf. Nha Trang* Tinh Khanh H6a. 
N.ha Trang. n gay. 03 nam 20JO 

PHO QfiVM GTVT KHANH HOA 

NGUYEN VAN DAN 


Co gid trj den 

khong Thai Han 

MS: 30H377427 


Taken from 44 -fEuZ7ve.jpg 
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In image 28 - 2KFmlQf.jpg we have a PayPal user named Viet Phap Vo and a transaction to 
GoDaddy.com LLC. He is most likely paying for a domain (that is also their current registrar 
for both websites). 

|t§ Install Guide... ^ (J) MEGA59% CS.R1N.RU - S...p|^ Farming.Sim... ^ 3DMGAME-Farmi... ^ P Transaction... 'J' P MyAcco... F Customer Su... Google Dieh j + 


* A PayPal, Inc. (US) https://www.paypal.com/vn/cgi-bin/webscr?cmd=account8(nav=0.0 




r C | | Q. '13.0.1.Update.and.Crack-3DM ^ ^ I O 1 t ^ ® ^ © # 

Loo Out | Heje | Security Center 


P PayPal 


Request Money | Merchant Services 


^ My Account 

Overview Add Funds Withdraw History Resolution Center Profile 

Welcome, Viet Phap Vo 

Account Type: Premier | Status: 


Resolution Center 



| About Us | Accounts | Fees j Privacy | Security Center | Contact Us | Leoal Agreements 

Copyright © 1999-2015 PayPal. All rights reserved- 
consumer advisory- PayPal Re. Ltd . the holder of PayPars stored value 
facility, does not require the approval of the Monetary Authority of Singapore. 

Users are advised to read the terms and conditions carefully 


Image 28 - 2KFmlQf.jpg 


In image 74 - DuTKpMz.jpg (see below) we have again the Paypal user Viet Phap listed, 
payments to GoDaddy, payments to G2A and Humble Bundle (to buy games to distribute 
via their website most likely) and payments received from Tomksoft S.A. There is also a 
Facebook tab open that reads: Vo Viet messaged you. 

Tomksoft S.A owns popads.net which is an ad network used for generating revenue. 

"WHEREAS, Tomksoft S.A. (Tomksoft) is a joint stock company located and registered in Costa 
Rica and is engaged in the business of providing Pop-under advertising through Popads.net. 
Popads.net is owned and operated by Tomksoft S.A." 
https://www.popads.net/terms-of-service.html 
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Image 74 - DuTKpMz.jpg 


In Vo Viet messaged you x Google Dich 


X [M Please complete your ident... X / F PayPal: Summary X^P Customer Support 


(©)■■ (j) ft PayPal, Inc. (US) [ https://www.paypal.com/myaccount/home 


Activity Send & Request Payments Wallet Shop 


Completed 

GoDaddy.com, LLC 

05 Payment 

Tomksoft S.A. 

04 Payment received 

Mellow Fish LTD 

O'J Payment 

sep G2ACOM LIMITED 

03 Payment 

Tomksoft S A 
' Payment received 

Humble Bundle, Inc. 
Preapproved payment 

G2A.COM Limited 

^3 Payment 


C Featherpunk.Prime 


*j ft ^ © 4 it © / off D IP: 14186.10927 

Log out 





let Phap! 

© 


t of PayPal V' 

Pay or send payments 




In image 103 - UPZ38qm.jpg we see the user vietphapl 23 logged into their Online.net 
account (top left-hand corner) and installing a server: 


(b online 


English ▼ logged in as vietphapl23 - 


Order - 


Domain 


Hosting 


Server - 


RPN - 


Storage ▼ 


AP/ - 


Support 


Installing Dedibox LT 2016 sd-121047 Gl Magic bar (server, domain, IP. ..) 


State 


Backup 

Service level & Options 

Licences 

Failover 

IPv6 

Statistics 

Logs 

Monitoring 
Hardware watch 
Secondary DNS 
Outsourcing 


Your server is being installed. Please wait between 45 to 60 minutes for ssh to be active and your system completely installed. 


Progression 


Start dedibox 

c 

OS installation 

Waiting 

System configuration 

Waiting 

Rebooting the server and finishing installation 

Waiting 


| CANCEL INSTALLATION 


Condition of Sales a- T&S dedicated server a - TSS dedirack a - TSS C14 <»- Legal notice s « 
Copyright ® 1999-201 7 - Online SAS - BP 438 - 75366 Peris CEDEX 08 - RCS Paris B 433 115904 
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In image 60 - nMbpq9d.jpg we can again see the user vietphapl 23 logged into Online.net 
and a list of servers and IP addresses: 


4 A https://console.online.net'en/server/list 


C | | Q. Search 


☆ £ © 4 


@ ▼ Disabled = 


£• online 

Server list 


English ▼ logged in as vietphapl 23 ▼ 

Order ▼ Domain Hosting API ▼ Support ▼ 

| 0 Magic bar (server, domain, IP...) 


Server list in DC2 

Id 


Offer 

IP 

Reverse 

Action 

✓ 55016 

© 

Dedibox Classic 2015 (sd-55016) 

© 62.210.131.67 

62-210-131-67.rev.poneytelecom.eu. 

Manage 

✓ 79615 

© 

Dedibox XC SSD (sd-79615) 

62.210.105.89 

62-210-105-89.rev.poneytelecom.eu. 

Manage 


Ubuntu 





X 79963 

(P 

Dedibox XC SSD (sd-79963) 





Defeian 


1 









Server list in DC3 

Id 


Offer 

IP 

Reverse 

Action 

X 49033 

© 

Ubuntu 

Dedibox Classic 2015 (vietphap6) 

O 62.210.209.178 

62-210-209-178.rev.poneytelecom.eu. 

Manage 


In image 79 - tuMltpF.jpg we have a Steam receipt with the username vietphapl 23 listed: 


Google Djeh ft /lyoujkie mmh... A The Pirate Ba... Q G2A.COM.... hi Thank yo... X SB 


ii co... [jj Facebook |§§ 


LIST GAME -... 


CS.RIN.RU - S... + 


© (D A https://mail.google.com/mail/u/0/?tab=wm#inbox/1578b7f96358afa0 


C ^ Search 


☆ £)©4'fl‘® ,r / off El IP : 14.186.92.180 = 


Google 


Gmail - 


Nhap vao day de bat cac thong bao tren man hinh cho Gmail. Tim hieu them An 

o f m- % Tac vu khac ▼ 1 trong t6ng s6 9.718 < 


O I- 

o- 


I Hop thu> din (5.556) 
Thu' gin diu sao 
Quan trong 
Thir da giri 
Thir nhap (16) 

► Vong ket noi 
Ca nhan 
Chuyen 
Sent Items 

Danh sach mo rong ▼ 


Thank you for your Steam purchase! 

Steam Support <noreply@steampowered.com> 
toi tdi g 


Hop tho" den x 


00:02 (2 phut triroc) 


STEAM’ 


Hello vietphap123 


Thank you for your recent transaction on Steam. 

The items below have been added to your Steam Library 

If you are new to Steam, you can get the free Steam application 


Dungeo 0 Robots 


Account name: vietphapl 23 | 

Invoice: 940514869255863555 

Date issued: 3 Oct, 2016 @ 10:02am PDT 

Payment method: PayPal 


This email message will serve as your receipt You can also vn 
History at anv time. 


) 


Refunds and/or returns may be granted for many products on Steam. Learn more 
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In image 95 - GPW3rxi.jpg we can see them logged into their Steam account: vietphap123 : 


m 


LIST GAME «IGGGAMES 


" CS.RIN.RU 


CS.RIN.RU - Steam Undergrc ^ CS.RIN.RU - Steam Undetgr. 


& CS.RIN.RU - Steam Undegtc (t Google Drive - anhWogu”iT^U 



I + ADD A GAME. 


VTEWFRIENOSUST 


= 01 


These are all the images we want to touch on. There are even more in the complete dump 
you can look at (such as screenshots of the old IGGGAMES kickasstorrent profile & 
messages with a user and a moderator, private tracker usernames, browsing private 
tracker trading forums and more). 

Again, you may download a complete set of the images from the imgur account dump at: 
Anonfiles: https://bit.lv/2Twp4jO 


PayPal Account 

We discovered a test page which contains their paypal account email address 
"iggcontact123@gmail.com": http://igg-games.com/test.html | http://archive.is/M2qBe 


Final Thoughts 

Remember folks, don't be like these imbeciles and reuse your username, email and 
password all over the internet -- especially when you operate a high-profile website 
focused on piracy. 

Who knows, maybe bringing this information to light will get a formal investigation started. 
Trying to remain anonymous seems to be at the bottom of their priority list. 














